diff options
author | Max Reitz <mreitz@redhat.com> | 2017-11-10 21:31:10 +0100 |
---|---|---|
committer | Max Reitz <mreitz@redhat.com> | 2017-11-17 18:21:31 +0100 |
commit | 23482f8a603a7fc591b770c94ff75651a7da88b2 (patch) | |
tree | 39d54de8da51f2434d09cf3ee1cd5b7317235677 /block/qcow2-refcount.c | |
parent | d470ad42acfc73c45d3e8ed5311a491160b4c100 (diff) | |
download | qemu-23482f8a603a7fc591b770c94ff75651a7da88b2.zip qemu-23482f8a603a7fc591b770c94ff75651a7da88b2.tar.gz qemu-23482f8a603a7fc591b770c94ff75651a7da88b2.tar.bz2 |
qcow2: Add bounds check to get_refblock_offset()
Reported-by: R. Nageswara Sastry <nasastry@in.ibm.com>
Buglink: https://bugs.launchpad.net/qemu/+bug/1728661
Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-id: 20171110203111.7666-5-mreitz@redhat.com
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
Diffstat (limited to 'block/qcow2-refcount.c')
-rw-r--r-- | block/qcow2-refcount.c | 26 |
1 files changed, 25 insertions, 1 deletions
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index 60b8eef..3de1ab5 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -3077,16 +3077,40 @@ done: return ret; } +static int64_t get_refblock_offset(BlockDriverState *bs, uint64_t offset) +{ + BDRVQcow2State *s = bs->opaque; + uint32_t index = offset_to_reftable_index(s, offset); + int64_t covering_refblock_offset = 0; + + if (index < s->refcount_table_size) { + covering_refblock_offset = s->refcount_table[index] & REFT_OFFSET_MASK; + } + if (!covering_refblock_offset) { + qcow2_signal_corruption(bs, true, -1, -1, "Refblock at %#" PRIx64 " is " + "not covered by the refcount structures", + offset); + return -EIO; + } + + return covering_refblock_offset; +} + static int qcow2_discard_refcount_block(BlockDriverState *bs, uint64_t discard_block_offs) { BDRVQcow2State *s = bs->opaque; - uint64_t refblock_offs = get_refblock_offset(s, discard_block_offs); + int64_t refblock_offs; uint64_t cluster_index = discard_block_offs >> s->cluster_bits; uint32_t block_index = cluster_index & (s->refcount_block_size - 1); void *refblock; int ret; + refblock_offs = get_refblock_offset(bs, discard_block_offs); + if (refblock_offs < 0) { + return refblock_offs; + } + assert(discard_block_offs != 0); ret = qcow2_cache_get(bs, s->refcount_block_cache, refblock_offs, |